Eight financial institutions also tapping into ECJ database

The Electoral Commission of Jamaica (ECJ) currently has contracts with eight financial institutions, granting them paid verification access to its voter ID database under similar terms as the credit bureaus.

Parliamentarian Julian Robinson, who served as an ECJ commissioner between 2017 and 2020, said while he knew of the bank contracts, he was not aware that credit bureaus were now included in the arrangement.

He pointed to Tax Administration Jamaica (TAJ), which has similar verification arrangements for driver’s licences, telling The Sunday Gleaner that the two state entities need to examine the current arrangements to ensure they are lawful.

“Both the ECJ and TAJ that provide verification services would need to ensure they are in compliance with the new Data Protection Act, given that these arrangements would have existed prior to the implementation of the act,” said Robinson, who is also the opposition spokesman on finance.

Contacted by our newsroom, TAJ Chief Corporate Communications Officer Meris Haughton said: “Any validation service provided to the credit bureaus would be in accordance with the necessary legislations and required permissions. TAJ takes seriously the matter of privacy and confidentiality in all we do.”

NO RESPONSE

CRIF CEO Terrence Cooper declined to address the issue when contacted.

“I am not in a position to answer you that and I am not going to answer you that,” he said.

CreditInfo boss Christopher Brown asked that Sunday Gleaner questions be emailed to him, but up to press time, he had not provided a response.

The Credit Report Act, which governs the operations of credit bureaus, states that such entities may obtain information from credit information providers such as banks, other licensed financial institutions, building societies, cooperative societies, the Development Bank of Jamaica, the National Housing Trust and the Students’ Loan Bureau.

The law also allows for the responsible minister to designate other bodies as credit information providers by notice published in the Jamaica Gazette and in at least one daily newspaper.

Further checks by The Sunday Gleaner on what obtains overseas revealed that CRIF High Mark, a licensed credit bureau in India, also offers identity verification to its clients.

“IDenCheck allows organisations to verify Customer KYC (know your customer) details against several government databases at the click of a button,” the company’s websites says.

It also says the IDenCheck ID verification methodology uses millions of data points, including device, network, behaviour and much more, to verify IDs. The company says it helps its customers avoid identity fraud by providing verification of driving licences, passports, voters’ IDs and other documents.

Cybersecurity expert Trevor Forrest told The Sunday Gleaner that the arrangements TAJ and ECJ have with credit bureaus and financial institutions should be examined closely.

“Without a doubt it is something we should be concerned about. The concerns are greater, though, with regard to the credit bureaus. Has the ECJ and TAJ sought permission from the owners of the information, meaning the citizens? Implied consent has now become an arguable concept with the advent of the data protection legislation,” said the CEO of 876 Technology Solutions.

According to Forrest, in the event of a data hack at a credit bureau, people’s valuable personal information could end up in the hands of threat actors and unknown third parties.

The cybersecurity expert argued that hackers in possession of a victim’s name, address and TRN could contact a bank and “become” that person and “conduct interesting transactions”.

“From a cybersecurity standpoint, it is a concerning thing when you provide PII (personal identifiable information) to third parties without a clear understanding of their security protocols,” he said.

tyrone.reid@gleanerjm.com

Companies using voter ID verification system

• Mayberry Investments Ltd

• Community & Workers of Ja Co-op Credit Union

• Sagicor Bank Jamaica Ltd

• Cornerstone Trust & Merchant Bank

• The Jamaica National Group

• First Heritage Co-op Credit Union

• JMMB Bank (Jamaica)

• National Commercial Bank

Income earned by ECJ from financial institutions

2019 – Approx $4,900

2020 – Approx $134,450

2021 – Approx $806,350

Total – Approx $945,700